Ctf Crypto
ljagiello/ctf-skills
Provides cryptography attack techniques for CTF challenges. An agent skill from ljagiello/ctf-skills.
Generates a CycloneDX Cryptographic Bill of Materials (CBOM) with the cdxgen cbom command, inventorying cryptographic algorithms, certificates, keys, and protocol usage from source code and hosts…
Install Crypto Bom
$ npx skills add cdxgen/cdxgen --skill crypto-bom -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install cdxgen/cdxgen crypto-bom --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/cdxgen/cdxgen.git skills-src && mkdir -p .claude/skills && cp -r skills-src/claude-plugin/skills/crypto-bom .claude/skills/crypto-bom && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "crypto-bom" agent skill from https://github.com/cdxgen/cdxgen/tree/master/claude-plugin/skills/crypto-bom into .claude/skills/crypto-bom/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "crypto-bom", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/cdxgen/cdxgen/tree/master/claude-plugin/skills/crypto-bomType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add cdxgen/cdxgen --skill crypto-bom -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install cdxgen/cdxgen crypto-bom --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/cdxgen/cdxgen.git skills-src && mkdir -p .agents/skills && cp -r skills-src/claude-plugin/skills/crypto-bom .agents/skills/crypto-bom && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "crypto-bom" agent skill from https://github.com/cdxgen/cdxgen/tree/master/claude-plugin/skills/crypto-bom into .agents/skills/crypto-bom/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "crypto-bom", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add cdxgen/cdxgen --skill crypto-bom -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install cdxgen/cdxgen crypto-bom --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/cdxgen/cdxgen.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/claude-plugin/skills/crypto-bom .cursor/skills/crypto-bom && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "crypto-bom" agent skill from https://github.com/cdxgen/cdxgen/tree/master/claude-plugin/skills/crypto-bom into .cursor/skills/crypto-bom/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "crypto-bom", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/cdxgen/cdxgen.git --path claude-plugin/skills/crypto-bom--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add cdxgen/cdxgen --skill crypto-bom -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install cdxgen/cdxgen crypto-bom --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/cdxgen/cdxgen.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/claude-plugin/skills/crypto-bom .gemini/skills/crypto-bom && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "crypto-bom" agent skill from https://github.com/cdxgen/cdxgen/tree/master/claude-plugin/skills/crypto-bom into .gemini/skills/crypto-bom/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "crypto-bom", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install cdxgen/cdxgen crypto-bomInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add cdxgen/cdxgen --skill crypto-bom -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/cdxgen/cdxgen.git skills-src && mkdir -p .github/skills && cp -r skills-src/claude-plugin/skills/crypto-bom .github/skills/crypto-bom && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "crypto-bom" agent skill from https://github.com/cdxgen/cdxgen/tree/master/claude-plugin/skills/crypto-bom into .github/skills/crypto-bom/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "crypto-bom", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add cdxgen/cdxgen --skill crypto-bom -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install cdxgen/cdxgen crypto-bom --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/cdxgen/cdxgen.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/claude-plugin/skills/crypto-bom .opencode/skills/crypto-bom && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "crypto-bom" agent skill from https://github.com/cdxgen/cdxgen/tree/master/claude-plugin/skills/crypto-bom into .opencode/skills/crypto-bom/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "crypto-bom", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
crypto-bom- GitHub stars
- 1.1k
- Token cost
- ~1.4k tokens
- SKILL.md length
- 476 words
- Files
- 1
- Skills in repo
- 17
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Generates a CycloneDX Cryptographic Bill of Materials (CBOM) with the cdxgen cbom command, inventorying cryptographic algorithms, certificates, keys, and protocol usage from source code and hosts…
- Works in 2 steps: Cryptographic assets do not carry purls.… → Source-derived algorithm components are…
- Asked for a CBOM
- SKILL.md covers Generate, What gets inventoried, Auditing the CBOM and Exploring the result, plus 3 more sections
- Calls java
What it does
Crypto Bom is an agent skill from cdxgen/cdxgen. Generates a CycloneDX Cryptographic Bill of Materials (CBOM) with the cdxgen cbom command, inventorying cryptographic algorithms, certificates, keys, and protocol usage from source code and hosts, and auditing them for weak or deprecated primitives. Use when asked for a CBOM, a cryptographic inventory, post-quantum readiness assessment, crypto algorithm discovery, or a review of certificates and key material in a codebase.
Its SKILL.md is about 1.4k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Cryptography. It works with Java and Linux. The repository describes itself as: Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with…. The licence is Apache-2.0.
When your agent uses it
- Asked for a CBOM
- A cryptographic inventory
- Post-quantum readiness assessment
- Crypto algorithm discovery
Example prompts
- “Use the crypto-bom skill to generate a CycloneDX Cryptographic Bill of Materials (CBOM) with the cdxgen cbom command, inventorying cryptographic…”
- “/crypto-bom”
Workflow steps
2 steps, taken from the first numbered list in SKILL.md.
- Cryptographic assets do not carry purls. That is correct; they are not packages. Do not treat a missing purl as a gap, and never invent one.
- Source-derived algorithm components are constrained to stay validator-safe: cdxgen emits only algorithms it can map to a known OID. An…
What it can do on your machine
Read from SKILL.md and the folder at commit e256966. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
java
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
cdxgen.github.io
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Crypto Bom loads about 1.4k tokens when it runs. Until then it costs about 109 tokens; SKILL.md has 476 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from cdxgen/cdxgen at commit e256966, republished under its Apache-2.0 licence (© cdxgen). 476 words, ~1,377 tokens.
Download SKILL.mdSave it as
.claude/skills/crypto-bom/SKILL.md (or your agent's skills folder).- name
- crypto-bom
- description
- Generates a CycloneDX Cryptographic Bill of Materials (CBOM) with the cdxgen cbom command, inventorying cryptographic algorithms, certificates, keys, and protocol usage from source code and hosts, and auditing them for weak or deprecated primitives. Use when asked for a CBOM, a cryptographic inventory, post-quantum readiness assessment, crypto algorithm discovery, or a review of certificates and key material in a codebase.
Cryptographic BOM
Use this skill when the user wants to know what cryptography a codebase or host actually uses — for post-quantum migration planning, crypto policy compliance, or finding weak primitives.
Read reference/safety.md first. CBOM source
analysis uses the atom companion, which needs no JDK on the native-binary
platforms (linux-amd64, linux-arm64 glibc, linux-amd64-musl, darwin-arm64,
windows-amd64). Only the jar-based triples (darwin-amd64, windows-arm64,
linux-arm64-musl) require Java >= 23 and fail silently below it, so verify
java -version there before interpreting a thin CBOM.
Generate
cbom -o /absolute/path/to/cbom.json /absolute/path/to/projectThe cbom command is not merely an alias with a flag. Invoking it sets:
| Setting | Value |
|---|---|
--include-crypto | on |
--evidence | on |
--deep | on |
--spec-version | 1.7, unless you pass one yourself |
Two combinations are rejected, not silently ignored:
cbom --component-type <t>— usecdxgen --include-cryptoinstead when you need component-type filtering.cbom -t os— crypto evidence collection analyses source with atom, which is meaningless and extremely slow against an OS inventory. Useobomfor operating-system installations (seeos-hardware-inventory).
The equivalent explicit invocation, when you want to vary one part:
cdxgen --include-crypto --evidence --deep \
-o /absolute/path/to/cbom.json /absolute/path/to/projectWhat gets inventoried
cryptographic-assetcomponents for algorithms, certificates, keys, and protocols- certificates and trusted key material discovered in the tree or host
- source-derived algorithm inventory from JavaScript and TypeScript via lightweight AST analysis
Note two modelling facts that surprise people:
- Cryptographic assets do not carry purls. That is correct; they are not packages. Do not treat a missing purl as a gap, and never invent one.
- Source-derived algorithm components are constrained to stay validator-safe: cdxgen emits only algorithms it can map to a known OID. An algorithm you can see in the source but not in the CBOM was most likely unmappable, not missed.
Show full SKILL.md (204 more words)Show less
Auditing the CBOM
cbom -o /absolute/path/to/cbom.json /absolute/path/to/project \
--bom-audit --bom-audit-categories cbomThe cbom category alias enables both rule sets:
| Category | Checks |
|---|---|
cbom-security | Weak or deprecated algorithms, insecure cipher modes, insufficient key sizes, outdated protocol versions |
cbom-compliance | Policy and standards conformance of the crypto inventory |
crypto-bom works as an alias for the same pair.
Audit an existing CBOM after the fact:
cdx-audit --bom /absolute/path/to/cbom.json --direct-bom-audit --categories cbomExploring the result
In cdxi (see bom-explore):
.cryptos— the full cryptographic asset list.sourcecryptos— only the JavaScript/TypeScript source-derived algorithm components.trusted— trusted keys and certificates
Reach for .sourcecryptos when the user's question is about code-level
algorithm usage rather than the certificates and keys shipped alongside it.
Crypto usage in Go, with data flow
For Go projects, evinse can trace crypto data flow rather than just
presence — which values reach a cryptographic operation:
cdxgen -t go -o /absolute/path/to/bom.json /absolute/path/to/project
evinse -i /absolute/path/to/bom.json -o /absolute/path/to/bom.crypto.json \
-l go --with-data-flow \
--golem-dataflow crypto --golem-dataflow-pattern-packs crypto \
/absolute/path/to/projectPrioritize components carrying cdx:golem:cryptoDataFlow=true and
cdx:golem:cryptoDataFlowCount, then pivot on the rendered
cryptographic-asset algorithms. See bom-evidence for the full Golem surface.
Never surface raw plaintext, ciphertext, key material, or embedded file
contents from Golem output. Review through the emitted cdx:golem:* counts,
categories, taint kinds, and algorithm/OID pivots.
Runtime crypto observation
To see crypto actually exercised at runtime rather than inferred from source,
tracebom has dedicated probes:
tracebom --cmd "node app.js" --trace-crypto --crypto-probe-mode <mode> \
-o /absolute/path/to/trace-cbom.jsonSee runtime-trace-bom.
Reference
- CBOM audit rules: https://cdxgen.github.io/cdxgen/#/BOM_AUDIT
- Custom properties: https://cdxgen.github.io/cdxgen/#/CUSTOM_PROPERTIES
- Go Evinse and Golem: https://cdxgen.github.io/cdxgen/#/GO_EVINSE_GOLEM
© cdxgen, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in claude-plugin/skills/crypto-bom of cdxgen/cdxgen.
Open the folder on GitHubat commit e256966
Compare with similar skills
Crypto Bom next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Crypto Bom this skillcdxgen/cdxgen | 1.1k | — | ~1.4k | Automated safety check: Pass | Apache-2.0 | |
| Ctf Cryptoljagiello/ctf-skills | 3.4k | — | ~11k | Automated safety check: Notes | MIT | |
| Constant-Time Analysistrailofbits/skills | 7.4k | — | ~3.3k | Automated safety check: Notes | CC-BY-SA-4.0 | |
| Azure Security Keyvault Keys Javamicrosoft/skills | 3.1k | 5 repos | ~2.9k | Automated safety check: Pass | MIT | |
| Security Reviewgithub/awesome-copilot | 40k | 1 repos | ~2.3k | Automated safety check: Notes | MIT | |
| Implementing Sigstore For Software Signingmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~3.2k | Automated safety check: Notes | Apache-2.0 |
Similar skills
- Official
Constant-Time Analysis
trailofbits/skills
Compiles cryptographic code and inspects the assembly or bytecode for variable-time instructions, then triages which flagged operations actually touch secrets.
- Official
Azure Security Keyvault Keys Java
microsoft/skills
Azure Key Vault Keys Java SDK for cryptographic key management.
- Official
Security Review
github/awesome-copilot
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching…
Implementing Sigstore For Software Signing
mukul975/Anthropic-Cybersecurity-Skills
Implements Sigstore-based software signing and verification using Cosign keyless signing, Rekor transparency log verification, and Fulcio certificate authority integration to establish cryptographic…
124 Java Secure Coding
jabrena/plinth
A skill your agent uses when you need to apply Java secure coding best practices — including validating untrusted inputs, defending against injection attacks with parameterized queries, minimizing…
More from cdxgen/cdxgen
All 17 skills in this repoAI Bom
cdxgen/cdxgen
Generates AI-BOM, MCP inventory, AI skill inventory, and AI authorship provenance documents with cdxgen, cataloging models, inference services, Hugging Face purls, MCP servers and their…
Bom Audit
cdxgen/cdxgen
Runs supply-chain risk analysis on CycloneDX BOMs with cdx-audit predictive auditing and cdxgen --bom-audit embedded rules, covering npm and PyPI package compromise posture, CI permission risk…
Bom Evidence
cdxgen/cdxgen
Enriches an existing CycloneDX BOM with occurrence, callstack, reachability, data-flow, and crypto-flow evidence using cdxgen evinse, including Go analysis via Golem and Rust analysis via Rusi, and…
Bom Explore
cdxgen/cdxgen
Explores and triages a CycloneDX BOM interactively with the cdxi REPL, using built-in commands for dependency trees, licenses, services, cryptographic assets, audit findings, evidence occurrences…
Bom Signing
cdxgen/cdxgen
Signs and verifies CycloneDX BOMs using cdxgen's native JSON Signature Format (JSF) implementation via cdx-sign and cdx-verify, supporting granular component, service, and annotation signatures…
Bom Convert Validate
cdxgen/cdxgen
Converts CycloneDX BOMs to SPDX 3.0.1 JSON-LD or between CycloneDX spec versions with cdx-convert, and validates BOMs against JSON schema, deep consistency checks, and OWASP SCVS and EU Cyber…
Related
Categories
Questions about Crypto Bom
What does Crypto Bom do?
Generates a CycloneDX Cryptographic Bill of Materials (CBOM) with the cdxgen cbom command, inventorying cryptographic algorithms, certificates, keys, and protocol usage from source code and hosts…. Crypto Bom is an agent skill from cdxgen/cdxgen. Generates a CycloneDX Cryptographic Bill of Materials (CBOM) with the cdxgen cbom command, inventorying cryptographic algorithms, certificates, keys, and protocol usage from source code and hosts, and auditing them for weak or deprecated primitives.
When should I use Crypto Bom?
Crypto Bom fits situations like: asked for a CBOM; A cryptographic inventory; post-quantum readiness assessment; crypto algorithm discovery.
How do I install Crypto Bom in Claude Code?
Run `npx skills add cdxgen/cdxgen --skill crypto-bom -a claude-code`. Or copy the skill folder (claude-plugin/skills/crypto-bom in cdxgen/cdxgen) into .claude/skills/crypto-bom in your project. Claude Code loads it when a task matches its description.
How do I install Crypto Bom in Codex?
Run `npx skills add cdxgen/cdxgen --skill crypto-bom -a codex`. Or copy the skill folder (claude-plugin/skills/crypto-bom in cdxgen/cdxgen) into .agents/skills/crypto-bom in your project. Codex loads it when a task matches its description.
Can I use Crypto Bom in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add cdxgen/cdxgen --skill crypto-bom -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/crypto-bom, .gemini/skills/crypto-bom, .github/skills/crypto-bom and .opencode/skills/crypto-bom in your project.
What does Crypto Bom need to run?
Going by SKILL.md and its folder, Crypto Bom needs the command-line tools its instructions call (java).
Does Crypto Bom access the network?
SKILL.md names 1 domain. As links in the text: cdxgen.github.io. This is read from the text; nothing was executed.
Is Crypto Bom safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Crypto Bom use?
Crypto Bom is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Crypto Bom use?
About 1.4k tokens (SKILL.md is roughly 5.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Crypto Bom?
Skills that share tags, products or a category with Crypto Bom: Ctf Crypto (ljagiello/ctf-skills, 3.4k stars), Constant-Time Analysis (trailofbits/skills, 7.4k stars), Azure Security Keyvault Keys Java (microsoft/skills, 3.1k stars) and Security Review (github/awesome-copilot, 40k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Crypto Bom?
cdxgen (a GitHub organization) maintains it in cdxgen/cdxgen, which has 1,085 GitHub stars. The repository holds 17 skills in this directory. The repository was last updated on October 7, 2026.
Source: cdxgen/cdxgen on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.